Bus guardian as well as method for monitoring communication between and among a number of nodes, node comprising such bus guardian, and distributed communication system comprising such nodes

ABSTRACT

In order to provide a bus guardian ( 30 ) for monitoring communication between and among a number of nodes ( 100 ), in particular between and among a number of electronic control units, the bus guardian ( 30 ) being designed for monitoring at least one cyclic time-triggered communication media access schedule for transmitting messages between and among the nodes ( 100 ) across at least one communication media ( 10 ), in particular across at least one channel ( 12 ) and across at least one optional further channel ( 14 ), and being assigned to at least one communication controller ( 40 ), the communication controller ( 40 ) comprising the communication media access schedule, wherein the bus guardian ( 30 ) as well as a corresponding method require neither any a priori knowledge of the communication schedule nor any configuration parameter and monitor the communication media access schedule of the communication controller ( 40 ) even during start-up of the communication, it is proposed that that the bus guardian ( 30 ) is able to learn, in particular within the first cycle, about said communication media access schedule, and that the bus guardian ( 30 ) makes use of the learned knowledge with respect to at least one possible schedule violation (SV 1,  SV 2,  SV 3 ), in particular with respect to at least one deviation from said communication media access schedule, for example during start-up of the communication.

The present invention relates in general to the architecture for communication systems, wherein for error containment in the time domain at least one bus guardian is used for each node of the communication system.

The present invention in particular relates to a bus guardian for monitoring communication between and among a number of nodes, in particular between and among a number of electronic control units, the bus guardian

-   -   being designed for monitoring at least one cyclic time-triggered         communication media access schedule for transmitting messages         between and among the nodes across at least one communication         media, in particular across at least one channel and across at         least one optional further channel, and     -   being assigned to at least one communication controller, the         communication controller comprising the communication media         access schedule.

The present invention further relates to a method for monitoring such communication.

In time-triggered communication systems, which for example can be used for message exchange in safety-relevant applications in vehicles, a situation in which one of the nodes due to a local malfunction temporarily or permanently impedes communication between the nodes of the communication system, is not tolerable.

In order to avoid such not tolerable situations in such time-triggered communication systems, a bus guardian as defined above in the chapter “Technical field” has been proposed; the function of such conventional bus guardian is known in the prior art for instance from communication systems for X-by wire applications, for example from FlexRay communication systems.

In this context the bus guardian avoids that a communication controller of one of the nodes of the communication system sends data at points in time, when it is not expected to do so, thereby blocking the communication media; as a consequence of such unexpected sending and thus blocking, no other communication controller of another node would be able to transmit data (so-called “babbling idiot” failure).

To avoid such “babbling idiot” failure, the prior art provides a certain set of supervision functions, which all need to be configured. Thus, according to the prior art, a costly configuration data interface to a microcontroller, in particular to the communication controller, is necessary to adjust the parameters.

Exemplary systems matching the above description are disclosed

-   -   in the prior art article “FlexRay International Workshop”, Apr.         16, 17, 2002, Munich, Protocol Overview by Florian Bogenberger,         Dr. Bernd Müller and Thomas Führer; cf.         http://www.dismi.unimo.it/Pavan/Sistemi%20Elettronici%20Industriali/protocol         lo_flexray.pdf),     -   in prior art document EP 1 355 461 A2,     -   in prior art document GB 2 386 804 A, and     -   in prior art document US 2004/0081079 A1.

The prior art article “A Prototype Implementation of a TTP/C Controller” by Hermann Kopetz, René Hexel, Andreas Krüger, Dietmar Millinger, Roman Nossal, Andreas Steininger, Christopher Temple, Thomas Führer, Roman Pallierer and Markus Krug (cf.

http:H/www.decomsys.com/publications/dm_rn_rp_prototypeimpl_ttpc_contr.pdf) discloses a prototype implementation of a T[ime]T[riggered]P[rotocol] named TTP/C. In this context, bus guardians play a key role in ensuring the required fail silent behaviour of the TTP module.

Apart from that, prior art document EP 1 355 460 A2 refers to a method for monitoring a communication media access schedule as described in the technical field above. However, for sufficient supervision the bus guardian according to prior art document EP 1 355 460 A2 needs a priori knowledge, implemented in the form of one or more configuration parameters.

Despite all efforts as described above, the problem remains that conventional bus guardians need a costly data interface to protect the communication media from timing failures of the communication controller.

Starting from the disadvantages and shortcomings as described above and taking the prior art as discussed into account, an object of the present invention is to provide a bus guardian as well as a corresponding operating method

-   -   requiring neither any a priori knowledge of the communication         schedule nor any configuration parameter and     -   monitoring the communication media access schedule of the         communication controller even during start-up of the         communication.

The object of the present invention is achieved by a bus guardian comprising the features of claim 1 as well as by a method comprising the features of claim 7. Advantageous embodiments and expedient improvements of the present invention are disclosed in the respective dependent claims.

The present invention is principally based on the idea to provide a bus guardian, in particular a FlexRay bus guardian, which has

-   -   neither a configuration parameter set through special interface     -   nor any a priori knowledge of the communication schedule.

In other words, the bus guardian does neither require any configuration, in particular any advance configuration or any pre-configuration, nor the implementation of a costly data interface but nevertheless grants supervision functionality, for example protects the communication media from timing failures of the communication controller.

This may be achieved in that the bus guardian is designed to learn within the first cycle about said communication media access schedule; this learned knowledge may be used regarding at least one possible schedule violation, in particular in order to differentiate or distinguish between at least one allowed deviation and at least one forbidden deviation caused by a failure of the communication controller during start-up.

A possible embodiment of a cycle of said communication media access schedule is a communication cycle comprising a periodic data transfer mechanism. Structure and timing of said communication cycle can for example be statically defined. Thus, the communication cycle may comprise a static segment only, i.e. a segment of the communication cycle where messages, in particular frames, are transmitted according to at least one statically defined T[ime]D[ivision]M[ultiple]A[ccess] scheme.

However, it is even possible that the communication cycle comprises beside the static segment also a dynamic segment, i.e. a segment where messages, in particular frames, are transmitted according to at least one mini-slotting algorithm. A communication cycle comprising static segments as well as dynamic segments is able to transmit state information as well as event information.

During start-up of the communication procedure the C[ommunication]C[ontroller] takes care of the start-up communication and may

-   -   succeed to start up communication, i.e. sends appropriate         communication elements,     -   succeed to integrate into a communication schedule, i.e.         performs clock synchronisation operation,     -   notice by its own mechanism if the communication controller does         not succeed to integrate into a communication schedule, for         example due to wrong configuration.

Consequently, the-bus guardian can advantageously rely on that the first (complete) communication cycle either is performed correctly by the C[ommunication]C[ontroller] or is aborted by the C[ommunication]C[ontroller]. Thus, the bus guardian can rely on the first communication cycle by the C[ommunication]C[ontroller] and learn about the communication schedule.

After learning in the first complete communication cycle(s) and with optionally taking some FlexRay protocol configuration constraints for plausibility checks into account, the bus guardian is able to perform its full operation and protect the media from faulty access.

To this aim, according to an advantageous embodiment of the present invention, the bus guardian is provided

-   -   with at least one clock signal from at least one clock unit         being assigned to and/or comprised in the bus guardian and/or     -   with at least one reset signal from any state and/or     -   with at least one arming signal, in particular with at least one         bus guardian ARMing signal, from the communication controller;         said arming signal is advantageously the first trigger signal         after starting the communication and designed for synchronising         the bus guardian and the communication controller.

The present invention further relates to a node, in particular to an electronic control unit, of a distributed communication system with a number of nodes being interconnected by the communication media, in particular by one or more communication channels, the node comprising one or more bus guardians as described above.

Thus, the present invention supports the idea of having decentralised or peripheral bus guardians in each communication node. Since according to a preferred embodiment of the present invention the clock synchronisation and error detection mechanisms within the communication controller are able to detect slight deviations, for example clock drift over temperature, in the nominal communication schedule, the bus guardian only has to intervene at coarse deviations, for example at a clock stop.

The communication media is advantageously a physical connection between at least two nodes, in particular between at least two communication controllers. A possible embodiment of the communication media is for example a redundant bus comprising two channels connecting said at least two nodes.

By means of the communication media, messages, in particular frames, are transmitted between and among the nodes, in particular between and among the respective communication controllers of the nodes. In this context, a frame comprises all information being transmitted in the time during which a communication controller may access the communication medium on the channel(s).

According to a preferred embodiment of the present invention, the node comprises at least one bus driver, in particular at least one transceiver unit, for example being comprised of at least one sender unit and of at least one receiver unit, the bus driver being connected to the communication controller, to the bus guardian as well as to the communication media.

Said bus driver advantageously connects the communication controller to the communication media. To prevent the communication media from timing failures of the communication controller, according to a preferred embodiment said bus driver can be controlled, in particular enabled and disabled, by the bus guardian.

For this reason, the bus driver may be provided

-   -   with at least one signal, in particular with at least one         transmit data input signal (so-called T×D signal), being         transmitted from the communication controller, and/or     -   with at least one transmit signal, in particular with at least         one transmit data enable signal (so-called T×EN signal: low         active), being transmitted from the communication controller         also to the bus guardian and/or     -   with at least one control signal, in particular with at least         one bus guardian enable input signal (so-called BGEN signal:         high active), being transmitted from the bus guardian.

Moreover, according to a preferred embodiment, the bus driver is designed for

-   -   transmitting and receiving the messages via the communication         media,     -   transmitting at least one signal, in particular at least one         receive data output signal (so-called R×D signal), to the         communication controller and     -   transmitting at least one receive signal, in particular at least         one receive data enable output signal (so-called R×EN signal),         to the communication controller as well as to the bus guardian.

Furthermore, according to a preferred embodiment, the node comprises at least one host unit, which can be implemented as the part of the node where at least one application software is executed. The host unit may be separated from the communication system or communication network by at least one C[ontroller]H[ost]I[nterface] which is arranged between the host unit and the communication controller.

The present invention further relates to a distributed fault-tolerant and/or time-triggered communication system or communication network with at least two nodes or electronic control units as described above.

Moreover, the present invention relates to a computer program

-   -   being able to run on at least one computer, in particular on at         least one microprocessor, for example on the communication         controller as described above, and     -   being programmed in order to execute a method as described         above.

According to a preferred embodiment of the present invention, the computer program can be stored on at least one R[ead]O[nly]M[emory] module, on at least one R[andom]A[ccess]M[emory] module or on at least one flash memory module.

The present invention finally relates to the use of at least one bus guardian as described above and/or of at least one node as described above and/or of at least one distributed communication system as described above and/or of the method as described above and/or of at least one computer program as described above for ensuring error containment in the time domain of the node, in particular for synchronizing clocks of the communication system transmitting messages between and among the nodes across the communication media, for example in an at least dual-channel environment, wherein differences in offset of the clocks as well as differences in rate of the clocks can be corrected.

As already discussed above, there are several options to embody as well as to improve the teaching of the present invention in an advantageous manner. To this aim, reference is made to the claims respectively dependent on claim 1, on claim 3, on claim 7 and on claim 13; further improvements, features and advantages of the present invention are explained below in more detail with reference to preferred embodiments by way of example and to the accompanying drawings where

FIG. 1 schematically shows an embodiment of an electronic control unit or node according to the present invention, the electronic control unit or node working according to the method of the present invention;

FIG. 2 schematically shows the steps of the method of the present invention according to which the electronic control unit or node of FIG. 1 works;

FIG. 3A schematically shows a first embodiment of a fault-tolerant time-triggered network system according to the present invention, the network system comprising several electronic control units or nodes of FIG. 1;

FIG. 3B schematically shows a second embodiment of a fault-tolerant time-triggered network system according to the present invention, the network system comprising several electronic control units or nodes of FIG. 1.

The same reference numerals are used for corresponding parts in FIG. 1 to FIG. 3B.

In order to avoid unnecessary repetitions, the following description regarding the embodiments, characteristics and advantages of the present invention relates (unless stated otherwise)

-   -   to the bus guardian 30 (cf. FIG. 1) according to the present         invention, i.e. there is no need of configuring this bus         guardian 30,     -   to the electronic control unit or node 100 (cf. FIG. 1)         according to the present invention,     -   to the first embodiment of the distributed network system 200         (cf.

FIG. 3A) according to the present invention as well as

-   -   to the second embodiment of the distributed network system 200′         (cf. FIG. 3B) according to the present invention, all         embodiments being operated according to the method (cf. FIG. 2)         of the present invention.

FIG. 1 depicts a communication node, namely an E[lectronic]C[ontrol]U[nit] 100; two or more of such communication nodes 100 are connected in a communication system, namely in a FlexRay communication system 200, 200′ as illustrated in FIGS. 3A, 3B.

The node 100 comprises basically five subsystems, namely

-   -   a power supply unit or battery 50 with a voltage regulator 52         assigned to this power supply unit 50,     -   a host unit 60,     -   a communication controller 40,     -   a bus driver 20 comprising a transceiver unit and being         connected to a communication media 10, namely to a data bus         comprising a first communication channel 12 and a redundant         second communication channel 14 in order to transmit and/or to         receive massages via the transceiver unit, and     -   a bus guardian 30 on FlexRay protocol basis, in particular a         so-called BGwop (=Bus Guardian without configuration parameter);         in this context, the BGwop 30 is embodied as a minimal bus         guardian for time-triggered architecture (FlexRay communication         systems or communication networks 200, 200′), wherein the bus         guardian 30 does not require any configuration parameters or any         further a priori knowledge.

The BGwop 30 is in general proposed to protect the communication media 10 from timing failures of the communication controller 40. To this aim, the BGwop 30 is connected to the communication controller 40 as well as to the bus driver 20. Beside this, the BGwop 30 is independent of the protocol communication controller.

In particular, the BGwop 30 monitors the communication media access schedule of the communication controller 40 in order to prevent the communication controller 40 from blocking the communication media 10 by temporarily or continuously sending messages (so-called “babbling idiot” failure); in order to maintain independence of the two redundant channels 12, 14, the node 100 may also comprise two bus drivers 20 and two BGwops 30.

If during start-up of the communication procedure the communication controller 40 succeeds to start up communication, i.e. is able to send appropriate communication elements, the communication controller 40

-   -   succeeds to integrate into a communication schedule, i.e.         performs clock synchronisation operation, or     -   does not succeed to integrate into a communication schedule, for         example due to wrong configuration.

In the latter case of not succeeding to integrate into a communication schedule, the communication controller 40 notices this failure by itself.

Consequently, the BGwop 30 can rely on that the first completely operated communication cycle either is correctly performed or is aborted by the communication controller 40. Thus, the BGwop 30 can learn about the communication schedule. After learning in the first complete communication cycle and with taking some FlexRay protocol configuration constraints for plausibility checks into account the BGwop 30 is able to perform its full operation and protect the communication media 10 from faulty access.

As can be taken from FIG. 1, the BGwop 30 is provided with the following input signals:

-   -   an arming signal 403, namely a bus guardian arming signal ARM,         from the communication controller 40, wherein a falling edge of         said signal ARM indicates a start of the communication cycle;     -   a transmit signal 423, namely a transmit data enable signal T×EN         wherein     -   the logical low state of said signal T×EN indicates a transmit         access and     -   said signal T×EN is transmitted from the communication         controller 40 not only to the BGwop 30 but also to the bus         driver 20;     -   a receive signal 243, namely a receive data enable output signal         R×EN, wherein     -   the logical low state of said signal R×EN indicates activity on         the communication media 10 and     -   said signal R×EN is transmitted from the bus driver 20 not only         to the BGwop 30 but also to the communication controller 40;     -   a reset signal 304 from any state 34 (cf. FIG. 2); and     -   a clock signal 303 from a clock unit 32 being assigned to the         BGwop 30; the clock signal 303 can alternatively be generated         internally in the BGwop 30.

The BGwop 30 puts out

-   -   a control signal 302, namely a bus guardian enable input signal         BGEN (HIGH active) to the transmitter unit of the bus driver 20         in order to enable and disable one or more output stages of the         bus driver 20, in particular for disabling transmission in case         of schedule violations SV1, SV2, SV3 (cf. FIG. 2) and     -   a signal 306, namely an error flag indication signal, for         example a single bit “error not” ERRN signal, to the host 60.

As can be further taken from FIG. 1, the bus driver 20 is

-   -   provided with a signal 402, namely with a transmit data input         signal T×D, being transmitted from the communication controller         40, and     -   designed for transmitting a signal 204, namely a receive data         output signal R×D, to the communication controller 40.

The host unit 60 is connected to the bus driver 20, to the BGwop 30 as well as to the communication controller 40. Beside this, the host unit 60 is designed for

-   -   transmitting a control signal 602 to the bus driver 20 and         receiving a status data signal 206 from the bus driver 20         (wherein neither said control signal 602 nor said status data         signal 206 are related to the actual communication within the         network 200); and     -   transmitting a signal 406 to the communication controller 40 and         receiving said signal 406 from the communication controller 40.

The power supply unit 50, namely the battery, is connected with ground GND and with the bus driver 20; the voltage regulator 52 is connected with

-   -   the power supply unit 50,     -   the host unit 60,     -   the communication controller 40 and     -   the bus driver 20.

The protocol of the FlexRay communication system 200 (cf. FIG. 3A), 200′ (cf. FIG. 3B) can be divided into various layers of a layer architecture comprising

-   -   a physical layer which defines how signals are actually         transmitted; one task of the physical layer is to detect errors         of the communication controller 40 in the time domain, which is         done by the BGwop 30;     -   a transfer layer which represents the kernel of the FlexRay         protocol;     -   a presentation layer which is concerned with frame filtering,         frame masking, and frame status handling; and     -   an application layer.

A state diagram of the BGwop 30 is depicted in FIG. 2. The BGwop 30

[i] enters BGwop-wake up mode after being provided with the reset signal 304 from any state 34;

[ii] enters BGwop-start up mode after being provided with the first falling edge of the arming signal 403;

[iii] enters BG-guarding mode after being provided with the second falling edge of the arming signal 403; and

[iv] enters BG_fail silent mode upon detection of one or more of the possible schedule violations SV1, SV2, SV3.

In the following the states or modes [i], [ii], [iii], [iv] of the BGwop 30 are described in more detail:

Step [i] of waking up comprises enabling the bus driver 20, namely the transmitter unit of the bus driver 20. During said step [i] the first type SV1 of the possible schedule violations SV1, SV2, SV3 can be detected

-   -   after a certain amount of negative edges of the transmit signal         423, for example after a maximum of 63 W[ake-]U[p]S[ymbols],         and/or     -   upon a negative edge of said transmit signal 423, while the         receive signal 243 is on logical low state, and/or     -   when said transmit signal 423 is on logical low state for longer         than a certain timeout dWU₀ of about or less than six         microseconds, and/or     -   when the clock unit 32 stops.

Step [ii] of starting up comprises the steps of

-   -   enabling the transmitter unit of the bus driver 20,     -   counting clock cycles in order to learn about the cycle time,         and     -   counting clock cycles until the first falling edge of said         transmit signal 423, wherein in particular during the first         cycle no dynamic frame is sent; in this context, a frame         comprises all information transmitted in one slot with one         identifier on one communication channel 12, 14 (in case of         FlexRay protocol any further, in particular the second,         communication channel 14 is redundant and thus optional).

During said step [ii] the second type SV2 of the possible schedule violations SV1, SV2, SV3 can be detected

-   -   after a certain amount of negative edges of said transmit signal         423, for example after a maximum of sixteen static slots per         C[ommunication]C[ontroller] 40, and/or     -   upon a negative edge of said transmit signal 423, while said         receive signal 243 is on logical low state, and/or     -   when said transmit signal 423 is on logical low state for longer         than a certain timeout of about 2.047 microseconds, and/or     -   when the cycle time is longer than a certain timeout of about         sixteen milliseconds, and/or     -   when the clock unit 32 stops.

Step [iii] of guarding comprises the steps of

-   -   enabling the transmitter unit of the bus driver 20, and     -   counting clock cycles in order to supervise the cycle time.

During said step [iii] the third type SV3 of the possible schedule violations SV1, SV2, SV3 can be detected

-   -   upon a certain, namely the X_(cycle)th, negative edge of the         transmit signal 423, wherein X_(Cycle) sets a protocol         configuration constraint, and/or     -   upon a negative edge of said transmit signal 423, while said         receive signal 243 is on logical low state, and/or     -   when said transmit signal 423 is on logical low state for longer         than a certain timeout of about 2.047 microseconds, and/or     -   when the cycle time deviates more than a certain margin from at         least one cycle time learned during step [ii], and/or     -   when a time span between respective falling edges of the arming         signal 403 and of the transmit signal 423 deviates more than a         certain margin from the time span learned during step [ii],         and/or     -   when the clock unit 32 stops.

The step [iv] of behaving fail silent comprises the steps of

-   -   disabling the transmitter unit of the bus driver 20, and     -   not monitoring the input signals except the reset signal 304.

Two embodiments of an x-by wire FlexRay communication system 200, 200′ are depicted in FIGS. 3A, 3B. The x-by wire FlexRay communication system 200, 200′ can be arranged

-   -   in linear bus topology (cf. FIG. 3A) or     -   in star bus topology (cf. FIG. 3B).

A possible combination of linear bus topology according to FIG. 3A and of star bus topology according to FIG. 3B makes the x-by wire FlexRay-communication system 200, 200′ very flexible.

LIST OF REFERENCE NUMERALS

-   100 node, in particular E[lectronic]C[ontrol]U[nit] -   10 communication media -   12 communication channel, in particular first communication channel,     of communication media 10 -   14 optional further, in particular redundant second, communication     channel of communication media 10 -   20 bus driver, in particular transceiver, for example combination of     transmitter and of receiver, assigned to communication media 10, in     particular assigned to communication channel 12 and/or to optional     further communication channel 14 -   204 signal, in particular receive data output signal R×D, from bus     driver 20 to communication controller 40 -   206 signal, in particular status data signal, from bus driver 20 to     host unit 60 -   243 receive signal, in particular receive data enable output signal     R×EN, from bus driver 20 to communication controller 40 as well as     to bus guardian 30 -   30 bus guardian, in particular without configuration parameter(s)     and without any other a priori knowledge -   32 clock unit, in particular clock -   302 control signal, in particular bus guardian enable input signal     BGEN: high active, from bus guardian 30 to bus driver 20 -   303 clock signal, in particular from clock unit 32 to bus guardian     30 -   304 reset signal from any state 34 -   306 signal, in particular error flag indication signal ERRN, from     bus guardian 30 to host unit 60 -   34 any state -   36 power on -   40 communication controller -   402 signal, in particular transmit data input signal T×D, from     communication controller 40 to bus driver 20 -   403 arming signal, in particular bus guardian arming signal ARM,     from communication controller 40 to bus guardian 30 -   406 signal between communication controller 40 and host unit 60 -   423 transmit signal, in particular transmit data enable signal T×EN:     low active, from communication controller 40 to bus driver 20 as     well as to bus guardian 30 -   50 power supply unit, in particular battery -   52 voltage regulator -   60 host unit, in particular application host -   602 signal, in particular control signal, from host unit 60 to bus     driver 20 -   200 communication system, in particular with linear topology (first     embodiment; cf. FIG. 3A) -   200′ communication system, in particular with star topology (second     embodiment; cf. FIG. 3B) -   ARM bus guardian arming signal from communication controller 40 to     bus guardian 30 -   BGEN bus guardian enable input signal (HIGH active) from bus     guardian 30 to bus driver 20 -   ERRN error flag indication signal between bus guardian 30 and host     unit 60 -   GND ground -   R×D receive data output signal from bus driver 20 to communication     controller 40 -   R×EN receive data enable output signal from bus driver 20 to     communication controller 40 as well as to bus guardian 30 -   SV1 schedule violation, in particular first type of deviation from     said communication media access schedule -   SV2 schedule violation, in particular second type of deviation from     said communication media access schedule -   SV3 schedule violation, in particular third type of deviation from     said communication media access schedule -   T×D transmit data input signal from communication controller 40 to     bus driver 20 -   T×EN transmit data enable signal (LOW active) from communication     controller 40 to bus driver 20 as well as to bus guardian 30 

1. A bus guardian for monitoring communication between and among a number of node, in particular between and among a number of electronic control units, the bus guardian being designed for monitoring at least one cyclic time-triggered communication media access schedule for transmitting messages between and among the nodes across at least one communication media, in particular across at least one channel and across at least one optional further channel, and being assigned to at least one communication controllers, the communication controller comprising the communication media access schedule, characterized in that the bus guardian is able to learn, in particular within the first cycle, about said communication media access schedule, and that the bus guardian makes use of the learned knowledge with respect to at least one possible schedule violation, in particular with respect to at least one deviation from said communication media access schedule, for example during start-up of the communication.
 2. The bus guardian according to claim 1, characterized by being provided with at least one clock signal from at least one clock unit being assigned to and/or comprised in the bus guardian and/or at least one reset signal from any state and/or at least one arming signal, in particular at least one bus guardian arming signal, from the communication controller.
 3. A node in particular an electronic control unit, of a distributed communication system with a number of nodes being interconnected by at least one communication media, in particular by at least one channel and by at least one optional further channel, characterized by at least one bus guardian according to claim
 1. 4. The node according to claim 3, characterized by at least one bus driver, in particular at least one transceiver unit, being connected—to the communication controller, to the bus guardian, as well as to the communication media, being controlled, in particular being enabled and disabled, by the bus guardian, being provided with at least one signal, in particular at least one transmit data input signal, being transmitted from the communication controller, at least one transmit signal, in particular at least one transmit data enable signal being transmitted from the communication controller also to the bus guardian, and at least one control signal, in particular at least one bus guardian enable input signal being transmitted from the bus guardian, and being designed for—transmitting and receiving the messages via the communication media, transmitting at least one signal, in particular at least one receive data output signal R×D, to the communication controller, and transmitting at least one receive signal, in particular at least one receive data enable output signal R×EN, to the communication controller as well as to the bus guardian.
 5. The node according to claim 3, characterized by at least one host unit being connected to the bus driver, to the bus guardian, as well as to the communication controller, and being designed for transmitting at least one signal, in particular at least one control signal, to the bus driver, receiving at least one signal, in particular at least one status data signal, from the bus driver, receiving at least one signal, in particular at least one error flag indication signal, from the bus guardian, and—transmitting and/or receiving at least one signal to and/or from the communication controller, and/or at least one power supply unit, in particular at least one battery, being connected with ground and with the bus driver, and/or—at least one voltage regulator being connected with the power supply unit, the host unit, the communication controller, and the bus driver.
 6. A distributed fault-tolerant and/or time-triggered communication system with at least two nodes according to claim
 3. 7. A method for monitoring communication between and among a number of nodes, in particular between and among a number of electronic control units, the method comprising the steps of transmitting messages between and among the nodes based on at least one cyclic time-triggered communication media access schedule being assigned to at least one communication controller and monitoring the communication media access schedule by means of at least one bus guardian, characterized in that the bus guardian is able to learn, in particular within the first cycle, about said communication media access schedule, and that the bus guardian makes use of the learned knowledge with respect to at least one possible schedule violation, in particular with respect to at least one deviation from said communication media access schedule, for example during start-up of the communication.
 8. The method according to claim 7, characterized in that the bus guardian, in particular after the power being switched on, i wakes up after being provided with at least one reset signal from any state, ii starts up after being provided with the first falling edge of at least one arming signal (403), in particular of at least one bus guardian arming signal, from the communication controller, iii enters guarding after being provided with the second falling edge of the arming signal, and iv behaves fail silent upon detection of at least one of the possible schedule violations
 9. The method according to claim 8, characterized in that step i of waking up comprises the step of enabling at least one bus drive, in particular at least part of at least one transceiver unit, for example at least one transmitter unit, and—that during said step i the first type of schedule violation can be detected after a predetermined amount of negative edges of at least one transmit signal, in particular of at least one transmit data enable signal from the communication controller to the bus driver as well as to bus guardian, and/or—upon a negative edge of said transmit signal, while at least one receive signal, in particular at least one receive data enable output signal, from the bus driver to the communication controller as well as to bus guardian is on logical low state, and/or when said transmit signal is on logical low state for at least one predetermined time period, in particular for longer than a certain timeout of about or less than six microseconds, and/or when at least one clock unit being assigned to the bus guardian stops.
 10. The method according to claim 8, characterized in that step ii of starting up comprises the steps of enabling the bus driver, in particular at least part of the transceiver unit, for example the transmitter unit, counting clock cycles in order to learn about the cycle time, and—counting clock cycles until the first falling edge of said transmit signal, wherein in particular during the first cycle no dynamic frame is sent, a frame comprising all information transmitted in at least one slot with at least one identifier on at least one channel, and that during said step ii the second type of schedule violation can be detected after a predetermined amount of negative edges of said transmit signal, and/or upon a negative edge of said transmit signal, while said receive signal is on logical low state, and/or—when said transmit signal is on logical low state for at least one predetermined time period, in particular for longer than a certain timeout of about 2.047 microseconds, and/or when the cycle time is longer than a certain timeout of about sixteen milliseconds, and/or when the clock unit stops.
 11. The method according to claim 8, characterized in that step iii of guarding comprises the steps of enabling the bus driver, in particular at least part of the transceiver unit, for example the transmitter unit,—counting clock cycles in order to supervise the cycle time, and that during said step iii the third type of schedule violation can be detected upon a certain, in particular the X_(cyc)i_(e)th, negative edge of the transmit signal, and/or—upon a negative edge of said transmit signal, while said receive signal is on logical low state, and/or when said transmit signal is on logical low state for at least one predetermined time period, in particular for longer than a certain timeout of about 2.047 microseconds, and/or—when the cycle time deviates more than a predetermined margin from at least one cycle time learned during said step ii, and/or when a time span between respective falling edges of the arming signal (403) and of the transmit signal deviates more than a predetermined margin from at least one time span learned during said step ii, and/or—when the clock unit stops.
 12. The method according to claim 7, characterized in that step iv of behaving fail silent comprises the steps of disabling the bus driver, in particular at least part of the transceiver unit, for example the transmitter unit, and not monitoring the input signals except the reset.
 13. A computer program being able to run on at least one computer, in particular on at least one microprocessor, for example on the communication controller, characterized in that the computer program is programmed in order to execute a method according claim
 7. 14. The computer program according to claim 13, characterized in that the computer program is stored on at least one ROM Read Only Memory module,—on at least one RAM Random Access Memory module, or on at least one flash memory unit.
 15. Use of at least one bus guardian a and/or of at least one node and/or of at least one distributed communication system and/or of the method and/or of at least one computer program for ensuring error containment in the time domain of the node, in particular for synchronizing clocks of the communication system transmitting messages between and among the nodes across the communication media, for example in an at least dual-channel environment, wherein differences in offset of the clocks as well as differences in rate of the clocks can be corrected, according to claim
 1. 